From 397af3e6a6ff4041894e2861b5fb0fae5c187997 Mon Sep 17 00:00:00 2001 From: Matt Johnston Date: Thu, 8 Mar 2018 23:23:19 +0800 Subject: [PATCH] kexhashbuf was much to small in kex fuzzers --- fuzzer-kexdh.c | 3 +-- fuzzer-kexecdh.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/fuzzer-kexdh.c b/fuzzer-kexdh.c index 7d3491c..f7abea2 100644 --- a/fuzzer-kexdh.c +++ b/fuzzer-kexdh.c @@ -54,8 +54,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { dropbear_exit("Bad kex value"); } - ses.kexhashbuf = buf_new(4); - buf_putint(ses.kexhashbuf, 12345); + ses.kexhashbuf = buf_new(KEXHASHBUF_MAX_INTS); kexdh_comb_key(dh_param, &dh_e, svr_opts.hostkey); /* kexhashbuf is freed in kexdh_comb_key */ diff --git a/fuzzer-kexecdh.c b/fuzzer-kexecdh.c index e97682c..693aecb 100644 --- a/fuzzer-kexecdh.c +++ b/fuzzer-kexecdh.c @@ -60,8 +60,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { buffer * ecdh_qs = buf_getstringbuf(fuzz.input); - ses.kexhashbuf = buf_new(4); - buf_putint(ses.kexhashbuf, 12345); + ses.kexhashbuf = buf_new(KEXHASHBUF_MAX_INTS); kexecdh_comb_key(ecdh_param, ecdh_qs, svr_opts.hostkey); /* kexhashbuf is freed in kexdh_comb_key */